Oracle Universal Work Queue CVE-2026-46966

Requires (1) network reachability to the Oracle E-Business Suite HTTP tier serving the Oracle Universal Work Queue Work Provider Site Level Administration component, (2) a valid low-privileged EBS application account (PR:L - not anonymous), and (3) an EBS 12.2 instance running an affected UWQ version in the 12.2.3-12.2.15 range with UWQ deployed. Exploitation is limited by High attack complexity (AC:H), meaning success depends on conditions outside the attacker's direct control such as specific UWQ configuration, particular work-provider state, or precise request crafting; no user interaction is needed (UI:N) and scope is unchanged (S:U), so impact is confined to the UWQ module itself rather than the broader EBS stack.

The CVSS 3.1 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H yields a 7.5 base score, driven by full CIA impact but tempered by high attack complexity and a required low-privileged account. No EPSS score, KEV listing, or POC is provided, and Oracle has not flagged active exploitation, so this currently looks like a serious-but-not-imminent issue rather than a drop-everything emergency. The realistic risk profile is highest for internet-exposed EBS deployments where standard application user accounts can reach the UWQ administration surface, since any authenticated user could attempt the chain; internal-only EBS instances with restricted UWQ access are materially lower risk. Key data gaps: no CWE, no independent technical write-up, and no patch version string beyond the June 2026 CPU bundle, so the precise root cause and exact patched build must be confirmed from the Oracle advisory itself.

An attacker who has obtained any low-privileged EBS application account (for example through phishing a help-desk user or reusing leaked credentials) authenticates to the EBS web tier and sends a crafted HTTP request to the Work Provider Site Level Administration function of UWQ, abusing the flaw to escalate within the module and take it over. Because AC is High, the attacker must satisfy non-trivial preconditions (specific configuration state, timing, or input crafting) before the exploit succeeds, and no public exploit identified at time of analysis means an attacker would need to derive the technique from the patch.